Wireguard Client to Client Connections

Installing and Using OpenWrt
1

I have wireguard set up and working well on my OpenWrt router. I've read through the forums and various other resources on the web and I can't for the life of me figure out why I can't get clients connected to my OpenWrt router via wireguard to talk to each other. I don't think it's routing, it's not allowed IPs, so I'm assuming it's the firewall or something else with the packet forwarding.

Here is the situation - I have a router (A) and client (1) and client (2). Clients 1 and 2 are at different internet locations. Client 1 and everything behind the router A have bi-directional communication. Same thing with client 2 and router A - both can talk to each other. But for the life of me I can't get Client 1 and Client 2 to talk to each other (via Router A).

I do have separate IPs set for Router A, Client 1, and Client 2 and behind Router A is an entire LAN that has separate addressing. That all works fine. Here is some detail:
Router A: 10.0.0.1
Router A LAN: 192.168.0.0/24
Client 1: 10.0.0.2
Client 2: 10.0.0.3

I can ping from 1 (10.0.0.2) to 10.0.0.1 and anywhere on 192.168.0.0/24.
I can ping from 2 (10.0.0.3) to 10.0.0.1 and anywhere on 192.168.0.0/24.
I can ping from anywhere on 192.168.0.0/24 to either 1 (10.0.0.2) or 2 (10.0.0.3).

What I can't do is ping from 1 (10.0.0.2) to 2 (10.0.0.3). I have the correct allowed ips set up. I have zone forwarding on. I don't know what to do next to troubleshoot but wireguard is setting up the routing tables properly (or at least I think it is) so I feel like the only thing left would be a firewall rule I might need or that is not configured properly.

Anyone who can help would be greatly appreciated.

2

Let's review your configs... starting with the OpenWrt router, and then also the configs of client 1 and client 2.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/firewall
1 Like